Vulnerabilities for homeassistant

First version without a known vulnerability: 2026.6.0

Details

• GHSA-5hxg-r395-fqxx2026-07-21

  Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

  Fixed in: 2026.6.0

• GHSA-x84v-g949-293w2026-06-19

  Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

  Fixed in: 2026.6.0

• GHSA-46j8-vpx8-6p722026-03-27

  Home Assistant has stored XSS in history-graphs

  Fixed in: 2026.01

• GHSA-r584-6283-p7xc2026-03-27

  Home Assistant has stored XSS in Map-card through malicious device name

  Fixed in: 2026.01

• GHSA-pp3g-xmm4-5cw92025-12-23

  Home Assistant Core before is vulnerable to Directory Traversal

  Fixed in: 2025.8.0

• GHSA-mq77-rv97-285m2025-10-14

  Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name

  Fixed in: 2025.10.2

• GHSA-m3pm-rpgg-5wj62025-02-18

  Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

  Fixed in: 2024.1.6

• GHSA-jqpc-rc7g-vf832023-12-15

  User accounts disclosed to unauthenticated actors on the LAN

  Fixed in: 2023.12.3

• GHSA-qhhj-7hrc-gqj52023-10-26

  Home Assistant vulnerable to account takeover via auth_callback login

  Fixed in: 2023.9.0

• GHSA-mh78-8f49-vjg32022-05-24

  Home Assistant information disclosure vulnerability

  Fixed in: 0.67.0